Index: deattack.c
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/deattack.c,v
retrieving revision 1.1.1.1.2.1
diff -u -r1.1.1.1.2.1 deattack.c
--- deattack.c	2000/10/28 23:00:48	1.1.1.1.2.1
+++ deattack.c	2001/02/13 00:28:07
@@ -85,7 +85,7 @@
 detect_attack(unsigned char *buf, u_int32_t len, unsigned char *IV)
 {
 	static u_int16_t *h = (u_int16_t *) NULL;
-	static u_int16_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
+	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
 	register u_int32_t i, j;
 	u_int32_t l;
 	register unsigned char *c;
Index: rsa.c
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/rsa.c,v
retrieving revision 1.1.1.1.2.4
diff -u -r1.1.1.1.2.4 rsa.c
--- rsa.c	2000/10/28 23:00:49	1.1.1.1.2.4
+++ rsa.c	2001/02/13 00:28:47
@@ -161,7 +161,7 @@
 	xfree(inbuf);
 }
 
-void
+int
 rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
 {
 	unsigned char *inbuf, *outbuf;
@@ -175,15 +175,16 @@
 	BN_bn2bin(in, inbuf);
 
 	if ((len = RSA_private_decrypt(ilen, inbuf, outbuf, key,
-	    RSA_PKCS1_PADDING)) <= 0)
-		fatal("rsa_private_decrypt() failed.");
-
-	BN_bin2bn(outbuf, len, out);
-
+	    RSA_PKCS1_PADDING)) <= 0) {
+		error("rsa_private_decrypt() failed");
+	} else {
+		BN_bin2bn(outbuf, len, out);
+	}
 	memset(outbuf, 0, olen);
 	memset(inbuf, 0, ilen);
 	xfree(outbuf);
 	xfree(inbuf);
+	return len;
 }
 
 /* Set whether to output verbose messages during key generation. */
Index: rsa.h
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/rsa.h,v
retrieving revision 1.2.2.2
diff -u -r1.2.2.2 rsa.h
--- rsa.h	2000/10/28 23:00:49	1.2.2.2
+++ rsa.h	2001/02/13 00:28:09
@@ -32,6 +32,6 @@
 int rsa_alive __P((void));
 
 void rsa_public_encrypt __P((BIGNUM * out, BIGNUM * in, RSA * prv));
-void rsa_private_decrypt __P((BIGNUM * out, BIGNUM * in, RSA * prv));
+int rsa_private_decrypt __P((BIGNUM * out, BIGNUM * in, RSA * prv));
 
 #endif				/* RSA_H */
Index: ssh-agent.c
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/ssh-agent.c,v
retrieving revision 1.2.2.3
diff -u -r1.2.2.3 ssh-agent.c
--- ssh-agent.c	2000/10/28 23:00:49	1.2.2.3
+++ ssh-agent.c	2001/02/13 00:28:09
@@ -191,7 +191,8 @@
 	private = lookup_private_key(key, NULL, 1);
 	if (private != NULL) {
 		/* Decrypt the challenge using the private key. */
-		rsa_private_decrypt(challenge, challenge, private->rsa);
+		if (rsa_private_decrypt(challenge, challenge, private->rsa) <= 0)
+			goto failure;
 
 		/* The response is MD5 of decrypted challenge plus session id. */
 		len = BN_num_bytes(challenge);
Index: sshconnect1.c
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/sshconnect1.c,v
retrieving revision 1.2.2.2
diff -u -r1.2.2.2 sshconnect1.c
--- sshconnect1.c	2000/10/28 23:00:51	1.2.2.2
+++ sshconnect1.c	2001/02/13 00:28:09
@@ -153,14 +153,17 @@
 	int i, len;
 
 	/* Decrypt the challenge using the private key. */
-	rsa_private_decrypt(challenge, challenge, prv);
+	/* XXX think about Bleichenbacher, too */
+	if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
+		packet_disconnect(
+		    "respond_to_rsa_challenge: rsa_private_decrypt failed");
 
 	/* Compute the response. */
 	/* The response is MD5 of decrypted challenge plus session id. */
 	len = BN_num_bytes(challenge);
 	if (len <= 0 || len > sizeof(buf))
-		packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
-				  len);
+		packet_disconnect(
+		    "respond_to_rsa_challenge: bad challenge length %d", len);
 
 	memset(buf, 0, sizeof(buf));
 	BN_bn2bin(challenge, buf + sizeof(buf) - len);
Index: sshd.c
===================================================================
RCS file: /usr2/ncvs/src/crypto/openssh/sshd.c,v
retrieving revision 1.6.2.3
diff -u -r1.6.2.3 sshd.c
--- sshd.c	2000/10/28 23:00:51	1.6.2.3
+++ sshd.c	2001/02/13 00:28:09
@@ -1149,6 +1149,7 @@
 {
 	int i, len;
 	int plen, slen;
+	int rsafail = 0;
 	BIGNUM *session_key_int;
 	unsigned char session_key[SSH_SESSION_KEY_LENGTH];
 	unsigned char cookie[8];
@@ -1270,7 +1271,7 @@
 	 * with larger modulus first).
 	 */
 	if (BN_cmp(sensitive_data.private_key->n, sensitive_data.host_key->n) > 0) {
-		/* Private key has bigger modulus. */
+		/* Server key has bigger modulus. */
 		if (BN_num_bits(sensitive_data.private_key->n) <
 		    BN_num_bits(sensitive_data.host_key->n) + SSH_KEY_BITS_RESERVED) {
 			fatal("do_connection: %s: private_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
@@ -1279,10 +1280,12 @@
 			      BN_num_bits(sensitive_data.host_key->n),
 			      SSH_KEY_BITS_RESERVED);
 		}
-		rsa_private_decrypt(session_key_int, session_key_int,
-				    sensitive_data.private_key);
-		rsa_private_decrypt(session_key_int, session_key_int,
-				    sensitive_data.host_key);
+		if (rsa_private_decrypt(session_key_int, session_key_int,
+		    sensitive_data.private_key) <= 0)
+			rsafail++;
+		if (rsa_private_decrypt(session_key_int, session_key_int,
+		    sensitive_data.host_key) <= 0)
+			rsafail++;
 	} else {
 		/* Host key has bigger modulus (or they are equal). */
 		if (BN_num_bits(sensitive_data.host_key->n) <
@@ -1293,10 +1296,12 @@
 			      BN_num_bits(sensitive_data.private_key->n),
 			      SSH_KEY_BITS_RESERVED);
 		}
-		rsa_private_decrypt(session_key_int, session_key_int,
-				    sensitive_data.host_key);
-		rsa_private_decrypt(session_key_int, session_key_int,
-				    sensitive_data.private_key);
+		if (rsa_private_decrypt(session_key_int, session_key_int,
+		    sensitive_data.host_key) < 0)
+			rsafail++;
+		if (rsa_private_decrypt(session_key_int, session_key_int,
+		    sensitive_data.private_key) < 0)
+			rsafail++;
 	}
 
 	compute_session_id(session_id, cookie,
@@ -1311,14 +1316,29 @@
 	 * least significant 256 bits of the integer; the first byte of the
 	 * key is in the highest bits.
 	 */
-	BN_mask_bits(session_key_int, sizeof(session_key) * 8);
-	len = BN_num_bytes(session_key_int);
-	if (len < 0 || len > sizeof(session_key))
-		fatal("do_connection: bad len from %s: session_key_int %d > sizeof(session_key) %d",
-		      get_remote_ipaddr(),
-		      len, sizeof(session_key));
-	memset(session_key, 0, sizeof(session_key));
-	BN_bn2bin(session_key_int, session_key + sizeof(session_key) - len);
+	if (!rsafail) {
+		BN_mask_bits(session_key_int, sizeof(session_key) * 8);
+		len = BN_num_bytes(session_key_int);
+		if (len < 0 || len > sizeof(session_key)) {
+			error("do_connection: bad session key len from %s: "
+			    "session_key_int %d > sizeof(session_key) %d",
+			    get_remote_ipaddr(), len, sizeof(session_key));
+			rsafail++;
+		} else {
+			memset(session_key, 0, sizeof(session_key));
+			BN_bn2bin(session_key_int,
+			    session_key + sizeof(session_key) - len);
+		}
+	}
+	if (rsafail) {
+		log("do_connection: generating a fake encryption key");
+		for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
+			if (i % 4 == 0)
+				rand = arc4random();
+			session_key[i] = rand & 0xff;
+			rand >>= 8;
+		}
+	}
 
 	/* Destroy the decrypted integer.  It is no longer needed. */
 	BN_clear_free(session_key_int);
